VYPR
← All advisories
Moderate severityNVD Advisory· Published Mar 16, 2007· Updated Apr 23, 2026

CVE-2007-0450

CVE-2007-0450

Description

Directory traversal vulnerability in Apache HTTP Server and Tomcat 5.x before 5.5.22 and 6.x before 6.0.10, when using certain proxy modules (mod_proxy, mod_rewrite, mod_jk), allows remote attackers to read arbitrary files via a .. (dot dot) sequence with combinations of (1) "/" (slash), (2) "\" (backslash), and (3) URL-encoded backslash (%5C) characters in the URL, which are valid separators in Tomcat but not in Apache.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.apache.tomcat:tomcatMaven
>= 5.0, < 5.5.225.5.22
org.apache.tomcat:tomcatMaven
>= 6.0, < 6.0.106.0.10

Affected products

2

Patches

3
ec7ff880dbc2

Merged revision 1203091 from tomcat/trunk:

https://github.com/apache/tomcatKonstantin KolinkoNov 17, 2011via ghsa
commit
2 files changed · +23 −4
  • java/org/apache/tomcat/util/buf/UDecoder.java+19 −4 modified
    @@ -92,7 +92,7 @@ public void convert( ByteChunk mb, boolean query )
             idx=idx2;
         }
 
-        boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
 
         for( int j=idx; j<end; j++, idx++ ) {
             if( buff[ j ] == '+' && query) {
@@ -160,6 +160,8 @@ public void convert( CharChunk mb, boolean query )
             idx=idx2;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         for( int j=idx; j<cend; j++, idx++ ) {
             if( buff[ j ] == '+' && query ) {
                 buff[idx]=( ' ' );
@@ -179,6 +181,9 @@ public void convert( CharChunk mb, boolean query )
 
                 j+=2;
                 int res=x2c( b1, b2 );
+                if (noSlash && (res == '/')) {
+                    throw EXCEPTION_SLASH;
+                }
                 buff[idx]=(char)res;
             }
         }
@@ -206,7 +211,11 @@ public void convert(MessageBytes mb, boolean query)
             if( strValue==null ) {
                 return;
             }
-            mb.setString( convert( strValue, query ));
+            try {
+                mb.setString( convert( strValue, query ));
+            } catch (RuntimeException ex) {
+                throw new DecodeException(ex.getMessage());
+            }
             break;
         case MessageBytes.T_CHARS:
             CharChunk charC=mb.getCharChunk();
@@ -236,6 +245,8 @@ public final String convert(String str, boolean query)
             return str;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         StringBuilder dec = new StringBuilder();    // decoded string output
         int strPos = 0;
         int strLen = str.length();
@@ -273,8 +284,12 @@ public final String convert(String str, boolean query)
                 // We throw the original exception - the super will deal with
                 // it
                 //                try {
-                dec.append((char)Integer.
-                           parseInt(str.substring(strPos + 1, strPos + 3),16));
+                char res = (char) Integer.parseInt(
+                        str.substring(strPos + 1, strPos + 3), 16);
+                if (noSlash && (res == '/')) {
+                    throw new IllegalArgumentException("noSlash");
+                }
+                dec.append(res);
                 strPos += 3;
             }
         }
  • webapps/docs/changelog.xml+4 −0 modified
    @@ -237,6 +237,10 @@
         HTTP response code when rejecting denied request. E.g. 404 instead
         of 403. (kkolinko)
       </add>
+      <fix>
+        Slightly improve performance of UDecoder.convert(). Align
+        <code>%2f</code> handling between implementations. (kkolinko)
+      </fix>
     </changelog>
   </subsection>
   <subsection name="Coyote">
0c5ec5b958f1

- Align %2f handling (aka CVE-2007-0450 fix) between implementations of UDecoder.convert().

https://github.com/apache/tomcatKonstantin KolinkoNov 17, 2011via ghsa
commit
1 file changed · +19 −4
  • java/org/apache/tomcat/util/buf/UDecoder.java+19 −4 modified
    @@ -92,7 +92,7 @@ public void convert( ByteChunk mb, boolean query )
             idx=idx2;
         }
 
-        boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
 
         for( int j=idx; j<end; j++, idx++ ) {
             if( buff[ j ] == '+' && query) {
@@ -160,6 +160,8 @@ public void convert( CharChunk mb, boolean query )
             idx=idx2;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         for( int j=idx; j<cend; j++, idx++ ) {
             if( buff[ j ] == '+' && query ) {
                 buff[idx]=( ' ' );
@@ -179,6 +181,9 @@ public void convert( CharChunk mb, boolean query )
 
                 j+=2;
                 int res=x2c( b1, b2 );
+                if (noSlash && (res == '/')) {
+                    throw EXCEPTION_SLASH;
+                }
                 buff[idx]=(char)res;
             }
         }
@@ -206,7 +211,11 @@ public void convert(MessageBytes mb, boolean query)
             if( strValue==null ) {
                 return;
             }
-            mb.setString( convert( strValue, query ));
+            try {
+                mb.setString( convert( strValue, query ));
+            } catch (RuntimeException ex) {
+                throw new DecodeException(ex.getMessage());
+            }
             break;
         case MessageBytes.T_CHARS:
             CharChunk charC=mb.getCharChunk();
@@ -236,6 +245,8 @@ public final String convert(String str, boolean query)
             return str;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         StringBuilder dec = new StringBuilder();    // decoded string output
         int strPos = 0;
         int strLen = str.length();
@@ -273,8 +284,12 @@ public final String convert(String str, boolean query)
                 // We throw the original exception - the super will deal with
                 // it
                 //                try {
-                dec.append((char)Integer.
-                           parseInt(str.substring(strPos + 1, strPos + 3),16));
+                char res = (char) Integer.parseInt(
+                        str.substring(strPos + 1, strPos + 3), 16);
+                if (noSlash && (res == '/')) {
+                    throw new IllegalArgumentException("noSlash");
+                }
+                dec.append(res);
                 strPos += 3;
             }
         }
19ec1ccd17fb

- Align %2f handling (aka CVE-2007-0450 fix) between implementations of UDecoder.convert().

https://github.com/apache/tomcatKonstantin KolinkoNov 17, 2011via ghsa
commit
1 file changed · +19 −4
  • java/org/apache/tomcat/util/buf/UDecoder.java+19 −4 modified
    @@ -92,7 +92,7 @@ public void convert( ByteChunk mb, boolean query )
             idx=idx2;
         }
 
-        boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
 
         for( int j=idx; j<end; j++, idx++ ) {
             if( buff[ j ] == '+' && query) {
@@ -160,6 +160,8 @@ public void convert( CharChunk mb, boolean query )
             idx=idx2;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         for( int j=idx; j<cend; j++, idx++ ) {
             if( buff[ j ] == '+' && query ) {
                 buff[idx]=( ' ' );
@@ -179,6 +181,9 @@ public void convert( CharChunk mb, boolean query )
 
                 j+=2;
                 int res=x2c( b1, b2 );
+                if (noSlash && (res == '/')) {
+                    throw EXCEPTION_SLASH;
+                }
                 buff[idx]=(char)res;
             }
         }
@@ -206,7 +211,11 @@ public void convert(MessageBytes mb, boolean query)
             if( strValue==null ) {
                 return;
             }
-            mb.setString( convert( strValue, query ));
+            try {
+                mb.setString( convert( strValue, query ));
+            } catch (RuntimeException ex) {
+                throw new DecodeException(ex.getMessage());
+            }
             break;
         case MessageBytes.T_CHARS:
             CharChunk charC=mb.getCharChunk();
@@ -236,6 +245,8 @@ public final String convert(String str, boolean query)
             return str;
         }
 
+        final boolean noSlash = !(ALLOW_ENCODED_SLASH || query);
+
         StringBuilder dec = new StringBuilder();    // decoded string output
         int strPos = 0;
         int strLen = str.length();
@@ -273,8 +284,12 @@ public final String convert(String str, boolean query)
                 // We throw the original exception - the super will deal with
                 // it
                 //                try {
-                dec.append((char)Integer.
-                           parseInt(str.substring(strPos + 1, strPos + 3),16));
+                char res = (char) Integer.parseInt(
+                        str.substring(strPos + 1, strPos + 3), 16);
+                if (noSlash && (res == '/')) {
+                    throw new IllegalArgumentException("noSlash");
+                }
+                dec.append(res);
                 strPos += 3;
             }
         }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

70

News mentions

0

No linked articles in our index yet.